refactor(goroutine): replace bare goroutines with managed executors

- Add internal/pkg/safego/ utility for safe goroutine launching
  with panic recovery, structured logging (slog + zap), and optional
  error callback support

- Replace 8 fire-and-forget goroutines in service layer:
  user_service.go (1), subscription_service.go (4), redeem_service.go (2),
  promo_service.go (1) — all now use safego.Go()

- Add inline panic recovery to 6 long-running goroutines:
  pricing_service.go scheduler loop
  Redis PubSub subscribers: tls_fingerprint/error_passthrough/api_key caches
  OAuth session cleanup: openai/oauth/geminicli
  S3 stream upload in sora_s3_storage.go

- All changes verified: go build PASS, service tests ALL PASS,
  repository tests ALL PASS

backend/internal/repository/error_passthrough_cache.go

@@ -103,6 +103,11 @@ func (c *errorPassthroughCache) NotifyUpdate(ctx context.Context) error {
 // SubscribeUpdates 订阅缓存更新通知
 func (c *errorPassthroughCache) SubscribeUpdates(ctx context.Context, handler func()) {
 	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				log.Printf("[ErrorPassthroughCache] Subscriber panic recovered: %v", r)
+			}
+		}()
 		sub := c.rdb.Subscribe(ctx, errorPassthroughPubSubKey)
 		defer func() { _ = sub.Close() }()